@tearleads/client-sdk 0.1.111 → 0.1.113

package/data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js

@@ -1,9 +1,11 @@
 import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { accessManifestCheckpoints, keyingCheckpointTables, principalPolicyCheckpoints, } from "../../sqlite/schema/index.js";
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../../sqlite/sqliteBindBudget.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
+import { excludedValue } from "../../sqlite/sqliteUpsert.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
-import { recordPrincipalPolicyOrganizationInTransaction } from "../principalPolicy/principalPolicyOrganizationPersistence.js";
+import { recordPrincipalPolicyOrganizationInTransaction, recordPrincipalPolicyOrganizationsInTransaction, } from "../principalPolicy/principalPolicyOrganizationPersistence.js";
 /** One key format per checkpoint identity, shared by every batch validator. */
 export function accessManifestObjectKey(identity) {
     return JSON.stringify([
@@ -37,6 +39,80 @@ async function loadPrincipalPolicyCheckpointRow(handle, identity) {
         .limit(1);
     return rows[0] ?? null;
 }
+// An access lookup binds its kind and organization once; a policy lookup its type.
+const ACCESS_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);
+const POLICY_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);
+const ACCESS_WRITE_BATCH_SIZE = sqliteInsertBatchSize(accessManifestCheckpoints);
+const POLICY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalPolicyCheckpoints);
+/** Splits `values` into consecutive slices of at most `size`. */
+function checkpointBatches(values, size) {
+    const result = [];
+    for (let index = 0; index < values.length; index += size)
+        result.push(values.slice(index, index + size));
+    return result;
+}
+/** Distinct ids per group key, in first-seen order. */
+function groupIds(items, group, id) {
+    const groups = new Map();
+    for (const item of items) {
+        const entry = groups.get(group(item)) ?? { first: item, ids: [] };
+        if (!entry.ids.includes(id(item)))
+            entry.ids.push(id(item));
+        groups.set(group(item), entry);
+    }
+    return groups;
+}
+/**
+ * Every stored access checkpoint row for `identities`, keyed by
+ * `accessManifestObjectKey`: one read per object kind and organization.
+ */
+export async function loadAccessManifestCheckpointRows(handle, identities) {
+    const stored = new Map();
+    const groups = groupIds(identities, (identity) => JSON.stringify([identity.objectKind, identity.organizationId]), (identity) => identity.objectId);
+    for (const { first, ids } of groups.values())
+        for (const batch of checkpointBatches(ids, ACCESS_LOOKUP_BATCH_SIZE)) {
+            const rows = await handle
+                .select({
+                objectId: accessManifestCheckpoints.objectId,
+                epoch: accessManifestCheckpoints.epoch,
+                manifestHash: accessManifestCheckpoints.manifestHash,
+            })
+                .from(accessManifestCheckpoints)
+                .where(and(eq(accessManifestCheckpoints.objectKind, first.objectKind), eq(accessManifestCheckpoints.organizationId, first.organizationId), inArray(accessManifestCheckpoints.objectId, batch)));
+            for (const { objectId, ...row } of rows)
+                stored.set(accessManifestObjectKey({ ...first, objectId }), row);
+        }
+    return stored;
+}
+/**
+ * Every stored policy checkpoint for `identities`, keyed by
+ * `principalPolicyKey`: one read per principal type.
+ */
+export async function loadStoredPrincipalPolicyCheckpoints(handle, identities) {
+    const stored = new Map();
+    const groups = groupIds(identities, (identity) => identity.principalType, (identity) => identity.principalId);
+    for (const { first, ids } of groups.values())
+        for (const batch of checkpointBatches(ids, POLICY_LOOKUP_BATCH_SIZE)) {
+            const rows = await handle
+                .select({
+                principalId: principalPolicyCheckpoints.principalId,
+                version: principalPolicyCheckpoints.version,
+                stateHash: principalPolicyCheckpoints.stateHash,
+            })
+                .from(principalPolicyCheckpoints)
+                .where(and(eq(principalPolicyCheckpoints.principalType, first.principalType), inArray(principalPolicyCheckpoints.principalId, batch)));
+            for (const row of rows) {
+                const checkpoint = {
+                    principalType: first.principalType,
+                    principalId: row.principalId,
+                    version: row.version,
+                    stateHash: row.stateHash,
+                };
+                stored.set(principalPolicyKey(checkpoint), checkpoint);
+            }
+        }
+    return stored;
+}
 /**
  * A loaded checkpoint row merged back with the identity it was looked up by —
  * the full checkpoint shape every comparison consumes.
@@ -98,6 +174,78 @@ export async function upsertPrincipalPolicyCheckpointInTransaction(tx, checkpoin
     })
         .run();
 }
+/**
+ * Upserts every checkpoint in multi-row statements; a repeated identity keeps
+ * its last checkpoint, as sequential upserts would.
+ */
+export async function upsertAccessManifestCheckpointsInTransaction(tx, checkpoints, updatedAt) {
+    const rows = new Map(checkpoints.map((checkpoint) => [
+        accessManifestObjectKey(checkpoint),
+        {
+            objectKind: checkpoint.objectKind,
+            organizationId: checkpoint.organizationId,
+            objectId: checkpoint.objectId,
+            epoch: checkpoint.epoch,
+            manifestHash: checkpoint.manifestHash,
+            updatedAt,
+        },
+    ]));
+    for (const batch of checkpointBatches([...rows.values()], ACCESS_WRITE_BATCH_SIZE))
+        await tx
+            .insert(accessManifestCheckpoints)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [
+                accessManifestCheckpoints.objectKind,
+                accessManifestCheckpoints.organizationId,
+                accessManifestCheckpoints.objectId,
+            ],
+            set: {
+                epoch: excludedValue(accessManifestCheckpoints.epoch),
+                manifestHash: excludedValue(accessManifestCheckpoints.manifestHash),
+                updatedAt: excludedValue(accessManifestCheckpoints.updatedAt),
+            },
+        })
+            .run();
+}
+/**
+ * Records every checkpoint's cache ownership, failing on the first conflict in
+ * order as `upsertPrincipalPolicyCheckpointInTransaction` would, then upserts
+ * the checkpoints in multi-row statements.
+ */
+export async function upsertPrincipalPolicyCheckpointsInTransaction(tx, checkpoints, updatedAt, organizationId) {
+    await recordPrincipalPolicyOrganizationsInTransaction(tx, checkpoints.map((checkpoint) => ({
+        organizationId,
+        principalId: checkpoint.principalId,
+        principalType: checkpoint.principalType,
+    })));
+    const rows = new Map(checkpoints.map((checkpoint) => [
+        principalPolicyKey(checkpoint),
+        {
+            principalType: checkpoint.principalType,
+            principalId: checkpoint.principalId,
+            version: checkpoint.version,
+            stateHash: checkpoint.stateHash,
+            updatedAt,
+        },
+    ]));
+    for (const batch of checkpointBatches([...rows.values()], POLICY_WRITE_BATCH_SIZE))
+        await tx
+            .insert(principalPolicyCheckpoints)
+            .values(batch)
+            .onConflictDoUpdate({
+            target: [
+                principalPolicyCheckpoints.principalType,
+                principalPolicyCheckpoints.principalId,
+            ],
+            set: {
+                version: excludedValue(principalPolicyCheckpoints.version),
+                stateHash: excludedValue(principalPolicyCheckpoints.stateHash),
+                updatedAt: excludedValue(principalPolicyCheckpoints.updatedAt),
+            },
+        })
+            .run();
+}
 // Lazily create the checkpoint tables on first access. Every load/save below
 // calls this, so the tables exist on demand; it is intentionally module-private
 // (no caller outside this file needs it, and exporting it tripped knip).

package/data/persistence/keyingCheckpoints/keyingCheckpointPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,8CAA8C,EAAE,MAAM,2DAA2D,CAAC;AAc3H,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,uCAAuC,CACrD,MAAwB;IAExB,OAAO,MAAM;SACV,cAAc,CAAC;QACd,EAAE,EAAE,0BAA0B,CAAC,WAAW;QAC1C,IAAI,EAAE,0BAA0B,CAAC,aAAa;KAC/C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { recordPrincipalPolicyOrganizationInTransaction } from \"../principalPolicy/principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\n/** Every principal with a durable policy checkpoint. */\nexport function listPrincipalPolicyCheckpointPrincipals(\n  handle: CheckpointHandle,\n): Promise<{ id: string; type: string }[]> {\n  return handle\n    .selectDistinct({\n      id: principalPolicyCheckpoints.principalId,\n      type: principalPolicyCheckpoints.principalType,\n    })\n    .from(principalPolicyCheckpoints);\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}
+{"version":3,"file":"keyingCheckpointPersistence.js","sourceRoot":"","sources":["keyingCheckpointPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,8CAA8C,EAC9C,+CAA+C,GAChD,MAAM,2DAA2D,CAAC;AAcnE,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,QAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2C;IAE3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAwB,EACxB,QAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,KAAK,EAAE,yBAAyB,CAAC,KAAK;QACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;KACrD,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC7D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC1D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,MAAwB,EACxB,QAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,MAAM;SACtB,MAAM,CAAC;QACN,OAAO,EAAE,0BAA0B,CAAC,OAAO;QAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EACpE,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CACjE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,yBAAyB,CAC1B,CAAC;AACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,0BAA0B,CAC3B,CAAC;AAEF,iEAAiE;AACjE,SAAS,iBAAiB,CAAI,MAAoB,EAAE,IAAY;IAC9D,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI;QACtD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,SAAS,QAAQ,CACf,KAAmB,EACnB,KAA0B,EAC1B,EAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAwB,EACxB,UAAuD;IAIvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,MAAM,MAAM,GAAG,QAAQ,CACrB,UAAU,EACV,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,EAChE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAChC,CAAC;IACF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,MAAM;iBACtB,MAAM,CAAC;gBACN,QAAQ,EAAE,yBAAyB,CAAC,QAAQ;gBAC5C,KAAK,EAAE,yBAAyB,CAAC,KAAK;gBACtC,YAAY,EAAE,yBAAyB,CAAC,YAAY;aACrD,CAAC;iBACD,IAAI,CAAC,yBAAyB,CAAC;iBAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC1D,EAAE,CAAC,yBAAyB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAClE,OAAO,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CACnD,CACF,CAAC;YACJ,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,IAAI,IAAI;gBACrC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,MAAwB,EACxB,UAAwD;IAExD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CACrB,UAAU,EACV,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EACpC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CACnC,CAAC;IACF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,MAAM;iBACtB,MAAM,CAAC;gBACN,WAAW,EAAE,0BAA0B,CAAC,WAAW;gBACnD,OAAO,EAAE,0BAA0B,CAAC,OAAO;gBAC3C,SAAS,EAAE,0BAA0B,CAAC,SAAS;aAChD,CAAC;iBACD,IAAI,CAAC,0BAA0B,CAAC;iBAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,0BAA0B,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EACjE,OAAO,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,CAAC,CACvD,CACF,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAwB,EACxB,UAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,QAA2C;IAE3C,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,GAAG;QACR,CAAC,CAAC;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,GAAG;SACP;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,uCAAuC,CACrD,MAAwB;IAExB,OAAO,MAAM;SACV,cAAc,CAAC;QACd,EAAE,EAAE,0BAA0B,CAAC,WAAW;QAC1C,IAAI,EAAE,0BAA0B,CAAC,aAAa;KAC/C,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,EAAgC,EAChC,UAAoC,EACpC,SAAiB;IAEjB,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,yBAAyB,CAAC,UAAU;YACpC,yBAAyB,CAAC,cAAc;YACxC,yBAAyB,CAAC,QAAQ;SACnC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,UAAqC,EACrC,SAAiB,EACjB,cAAmC;IAEnC,MAAM,8CAA8C,CAAC,EAAE,EAAE;QACvD,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE;SACL,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC;SACX,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,0BAA0B,CAAC,aAAa;YACxC,0BAA0B,CAAC,WAAW;SACvC;QACD,GAAG,EAAE,GAAG;KACT,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAgC,EAChC,WAAgD,EAChD,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9B,uBAAuB,CAAC,UAAU,CAAC;QACnC;YACE,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,SAAS;SACV;KACF,CAAC,CACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,CACnC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAClB,uBAAuB,CACxB;QACC,MAAM,EAAE;aACL,MAAM,CAAC,yBAAyB,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,yBAAyB,CAAC,UAAU;gBACpC,yBAAyB,CAAC,cAAc;gBACxC,yBAAyB,CAAC,QAAQ;aACnC;YACD,GAAG,EAAE;gBACH,KAAK,EAAE,aAAa,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBACrD,YAAY,EAAE,aAAa,CAAC,yBAAyB,CAAC,YAAY,CAAC;gBACnE,SAAS,EAAE,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC;aAC9D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,EAAgC,EAChC,WAAiD,EACjD,SAAiB,EACjB,cAAmC;IAEnC,MAAM,+CAA+C,CACnD,EAAE,EACF,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/B,cAAc;QACd,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9B,kBAAkB,CAAC,UAAU,CAAC;QAC9B;YACE,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS;SACV;KACF,CAAC,CACH,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,CACnC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAClB,uBAAuB,CACxB;QACC,MAAM,EAAE;aACL,MAAM,CAAC,0BAA0B,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC;aACb,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,0BAA0B,CAAC,aAAa;gBACxC,0BAA0B,CAAC,WAAW;aACvC;YACD,GAAG,EAAE;gBACH,OAAO,EAAE,aAAa,CAAC,0BAA0B,CAAC,OAAO,CAAC;gBAC1D,SAAS,EAAE,aAAa,CAAC,0BAA0B,CAAC,SAAS,CAAC;gBAC9D,SAAS,EAAE,aAAa,CAAC,0BAA0B,CAAC,SAAS,CAAC;aAC/D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,KAAK,UAAU,4BAA4B,CAAC,OAAgB;IAC1D,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgB,EAChB,UAA4B,EAC5B,cAAsB,EACtB,QAAgB;IAEhB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE;QACpD,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB,EAChB,aAAmC,EACnC,WAAmB;IAEnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE;QACrD,aAAa;QACb,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAAqC,EACrC,IAAuC;IAEvC,IACE,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC/C,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  AccessManifestCheckpoint,\n  AccessObjectKind,\n  ManagedPrincipalKind,\n  PrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  accessManifestCheckpoints,\n  keyingCheckpointTables,\n  principalPolicyCheckpoints,\n} from \"../../sqlite/schema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport {\n  recordPrincipalPolicyOrganizationInTransaction,\n  recordPrincipalPolicyOrganizationsInTransaction,\n} from \"../principalPolicy/principalPolicyOrganizationPersistence\";\n\ntype CheckpointHandle = ClientSQLiteDatabase | ClientSQLiteTransactionScope;\n\ntype AccessManifestCheckpointIdentity = Pick<\n  AccessManifestCheckpoint,\n  \"objectKind\" | \"organizationId\" | \"objectId\"\n>;\n\ntype PrincipalPolicyCheckpointIdentity = Pick<\n  PrincipalPolicyCheckpoint,\n  \"principalType\" | \"principalId\"\n>;\n\n/** One key format per checkpoint identity, shared by every batch validator. */\nexport function accessManifestObjectKey(\n  identity: AccessManifestCheckpointIdentity,\n): string {\n  return JSON.stringify([\n    identity.objectKind,\n    identity.organizationId,\n    identity.objectId,\n  ]);\n}\n\nexport function principalPolicyKey(\n  identity: PrincipalPolicyCheckpointIdentity,\n): string {\n  return JSON.stringify([identity.principalType, identity.principalId]);\n}\n\nasync function loadAccessManifestCheckpointRow(\n  handle: CheckpointHandle,\n  identity: AccessManifestCheckpointIdentity,\n): Promise<Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\"> | null> {\n  const rows = await handle\n    .select({\n      epoch: accessManifestCheckpoints.epoch,\n      manifestHash: accessManifestCheckpoints.manifestHash,\n    })\n    .from(accessManifestCheckpoints)\n    .where(\n      and(\n        eq(accessManifestCheckpoints.objectKind, identity.objectKind),\n        eq(accessManifestCheckpoints.organizationId, identity.organizationId),\n        eq(accessManifestCheckpoints.objectId, identity.objectId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\nasync function loadPrincipalPolicyCheckpointRow(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<Pick<PrincipalPolicyCheckpoint, \"version\" | \"stateHash\"> | null> {\n  const rows = await handle\n    .select({\n      version: principalPolicyCheckpoints.version,\n      stateHash: principalPolicyCheckpoints.stateHash,\n    })\n    .from(principalPolicyCheckpoints)\n    .where(\n      and(\n        eq(principalPolicyCheckpoints.principalType, identity.principalType),\n        eq(principalPolicyCheckpoints.principalId, identity.principalId),\n      ),\n    )\n    .limit(1);\n  return rows[0] ?? null;\n}\n\n// An access lookup binds its kind and organization once; a policy lookup its type.\nconst ACCESS_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);\nconst POLICY_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);\nconst ACCESS_WRITE_BATCH_SIZE = sqliteInsertBatchSize(\n  accessManifestCheckpoints,\n);\nconst POLICY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(\n  principalPolicyCheckpoints,\n);\n\n/** Splits `values` into consecutive slices of at most `size`. */\nfunction checkpointBatches<T>(values: readonly T[], size: number): T[][] {\n  const result: T[][] = [];\n  for (let index = 0; index < values.length; index += size)\n    result.push(values.slice(index, index + size));\n  return result;\n}\n\n/** Distinct ids per group key, in first-seen order. */\nfunction groupIds<T>(\n  items: readonly T[],\n  group: (item: T) => string,\n  id: (item: T) => string,\n): Map<string, { readonly first: T; readonly ids: string[] }> {\n  const groups = new Map<string, { first: T; ids: string[] }>();\n  for (const item of items) {\n    const entry = groups.get(group(item)) ?? { first: item, ids: [] };\n    if (!entry.ids.includes(id(item))) entry.ids.push(id(item));\n    groups.set(group(item), entry);\n  }\n  return groups;\n}\n\n/**\n * Every stored access checkpoint row for `identities`, keyed by\n * `accessManifestObjectKey`: one read per object kind and organization.\n */\nexport async function loadAccessManifestCheckpointRows(\n  handle: CheckpointHandle,\n  identities: readonly AccessManifestCheckpointIdentity[],\n): Promise<\n  Map<string, Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\">>\n> {\n  const stored = new Map<\n    string,\n    Pick<AccessManifestCheckpoint, \"epoch\" | \"manifestHash\">\n  >();\n  const groups = groupIds(\n    identities,\n    (identity) =>\n      JSON.stringify([identity.objectKind, identity.organizationId]),\n    (identity) => identity.objectId,\n  );\n  for (const { first, ids } of groups.values())\n    for (const batch of checkpointBatches(ids, ACCESS_LOOKUP_BATCH_SIZE)) {\n      const rows = await handle\n        .select({\n          objectId: accessManifestCheckpoints.objectId,\n          epoch: accessManifestCheckpoints.epoch,\n          manifestHash: accessManifestCheckpoints.manifestHash,\n        })\n        .from(accessManifestCheckpoints)\n        .where(\n          and(\n            eq(accessManifestCheckpoints.objectKind, first.objectKind),\n            eq(accessManifestCheckpoints.organizationId, first.organizationId),\n            inArray(accessManifestCheckpoints.objectId, batch),\n          ),\n        );\n      for (const { objectId, ...row } of rows)\n        stored.set(accessManifestObjectKey({ ...first, objectId }), row);\n    }\n  return stored;\n}\n\n/**\n * Every stored policy checkpoint for `identities`, keyed by\n * `principalPolicyKey`: one read per principal type.\n */\nexport async function loadStoredPrincipalPolicyCheckpoints(\n  handle: CheckpointHandle,\n  identities: readonly PrincipalPolicyCheckpointIdentity[],\n): Promise<Map<string, PrincipalPolicyCheckpoint>> {\n  const stored = new Map<string, PrincipalPolicyCheckpoint>();\n  const groups = groupIds(\n    identities,\n    (identity) => identity.principalType,\n    (identity) => identity.principalId,\n  );\n  for (const { first, ids } of groups.values())\n    for (const batch of checkpointBatches(ids, POLICY_LOOKUP_BATCH_SIZE)) {\n      const rows = await handle\n        .select({\n          principalId: principalPolicyCheckpoints.principalId,\n          version: principalPolicyCheckpoints.version,\n          stateHash: principalPolicyCheckpoints.stateHash,\n        })\n        .from(principalPolicyCheckpoints)\n        .where(\n          and(\n            eq(principalPolicyCheckpoints.principalType, first.principalType),\n            inArray(principalPolicyCheckpoints.principalId, batch),\n          ),\n        );\n      for (const row of rows) {\n        const checkpoint = {\n          principalType: first.principalType,\n          principalId: row.principalId,\n          version: row.version,\n          stateHash: row.stateHash,\n        };\n        stored.set(principalPolicyKey(checkpoint), checkpoint);\n      }\n    }\n  return stored;\n}\n\n/**\n * A loaded checkpoint row merged back with the identity it was looked up by —\n * the full checkpoint shape every comparison consumes.\n */\nexport async function loadStoredAccessManifestCheckpoint(\n  handle: CheckpointHandle,\n  checkpoint: AccessManifestCheckpoint,\n): Promise<AccessManifestCheckpoint | null> {\n  const row = await loadAccessManifestCheckpointRow(handle, checkpoint);\n  return row ? { ...checkpoint, ...row } : null;\n}\n\nexport async function loadStoredPrincipalPolicyCheckpoint(\n  handle: CheckpointHandle,\n  identity: PrincipalPolicyCheckpointIdentity,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  const row = await loadPrincipalPolicyCheckpointRow(handle, identity);\n  return row\n    ? {\n        principalType: identity.principalType,\n        principalId: identity.principalId,\n        ...row,\n      }\n    : null;\n}\n\n/** Every principal with a durable policy checkpoint. */\nexport function listPrincipalPolicyCheckpointPrincipals(\n  handle: CheckpointHandle,\n): Promise<{ id: string; type: string }[]> {\n  return handle\n    .selectDistinct({\n      id: principalPolicyCheckpoints.principalId,\n      type: principalPolicyCheckpoints.principalType,\n    })\n    .from(principalPolicyCheckpoints);\n}\n\nexport async function upsertAccessManifestCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: AccessManifestCheckpoint,\n  updatedAt: string,\n): Promise<void> {\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(accessManifestCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        accessManifestCheckpoints.objectKind,\n        accessManifestCheckpoints.organizationId,\n        accessManifestCheckpoints.objectId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\nexport async function upsertPrincipalPolicyCheckpointInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoint: PrincipalPolicyCheckpoint,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationInTransaction(tx, {\n    organizationId,\n    principalId: checkpoint.principalId,\n    principalType: checkpoint.principalType,\n  });\n  const row = { ...checkpoint, updatedAt };\n  await tx\n    .insert(principalPolicyCheckpoints)\n    .values(row)\n    .onConflictDoUpdate({\n      target: [\n        principalPolicyCheckpoints.principalType,\n        principalPolicyCheckpoints.principalId,\n      ],\n      set: row,\n    })\n    .run();\n}\n\n/**\n * Upserts every checkpoint in multi-row statements; a repeated identity keeps\n * its last checkpoint, as sequential upserts would.\n */\nexport async function upsertAccessManifestCheckpointsInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoints: readonly AccessManifestCheckpoint[],\n  updatedAt: string,\n): Promise<void> {\n  const rows = new Map(\n    checkpoints.map((checkpoint) => [\n      accessManifestObjectKey(checkpoint),\n      {\n        objectKind: checkpoint.objectKind,\n        organizationId: checkpoint.organizationId,\n        objectId: checkpoint.objectId,\n        epoch: checkpoint.epoch,\n        manifestHash: checkpoint.manifestHash,\n        updatedAt,\n      },\n    ]),\n  );\n  for (const batch of checkpointBatches(\n    [...rows.values()],\n    ACCESS_WRITE_BATCH_SIZE,\n  ))\n    await tx\n      .insert(accessManifestCheckpoints)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [\n          accessManifestCheckpoints.objectKind,\n          accessManifestCheckpoints.organizationId,\n          accessManifestCheckpoints.objectId,\n        ],\n        set: {\n          epoch: excludedValue(accessManifestCheckpoints.epoch),\n          manifestHash: excludedValue(accessManifestCheckpoints.manifestHash),\n          updatedAt: excludedValue(accessManifestCheckpoints.updatedAt),\n        },\n      })\n      .run();\n}\n\n/**\n * Records every checkpoint's cache ownership, failing on the first conflict in\n * order as `upsertPrincipalPolicyCheckpointInTransaction` would, then upserts\n * the checkpoints in multi-row statements.\n */\nexport async function upsertPrincipalPolicyCheckpointsInTransaction(\n  tx: ClientSQLiteTransactionScope,\n  checkpoints: readonly PrincipalPolicyCheckpoint[],\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await recordPrincipalPolicyOrganizationsInTransaction(\n    tx,\n    checkpoints.map((checkpoint) => ({\n      organizationId,\n      principalId: checkpoint.principalId,\n      principalType: checkpoint.principalType,\n    })),\n  );\n  const rows = new Map(\n    checkpoints.map((checkpoint) => [\n      principalPolicyKey(checkpoint),\n      {\n        principalType: checkpoint.principalType,\n        principalId: checkpoint.principalId,\n        version: checkpoint.version,\n        stateHash: checkpoint.stateHash,\n        updatedAt,\n      },\n    ]),\n  );\n  for (const batch of checkpointBatches(\n    [...rows.values()],\n    POLICY_WRITE_BATCH_SIZE,\n  ))\n    await tx\n      .insert(principalPolicyCheckpoints)\n      .values(batch)\n      .onConflictDoUpdate({\n        target: [\n          principalPolicyCheckpoints.principalType,\n          principalPolicyCheckpoints.principalId,\n        ],\n        set: {\n          version: excludedValue(principalPolicyCheckpoints.version),\n          stateHash: excludedValue(principalPolicyCheckpoints.stateHash),\n          updatedAt: excludedValue(principalPolicyCheckpoints.updatedAt),\n        },\n      })\n      .run();\n}\n\n// Lazily create the checkpoint tables on first access. Every load/save below\n// calls this, so the tables exist on demand; it is intentionally module-private\n// (no caller outside this file needs it, and exporting it tripped knip).\nasync function ensureKeyingCheckpointTables(execSql: ExecSql): Promise<void> {\n  await ensureSqlTables(execSql, keyingCheckpointTables);\n}\n\nexport async function loadAccessManifestCheckpoint(\n  execSql: ExecSql,\n  objectKind: AccessObjectKind,\n  organizationId: string,\n  objectId: string,\n): Promise<AccessManifestCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadAccessManifestCheckpointRow(db, {\n    objectKind,\n    organizationId,\n    objectId,\n  });\n\n  return row ? { objectKind, objectId, organizationId, ...row } : null;\n}\n\nexport async function loadPrincipalPolicyCheckpoint(\n  execSql: ExecSql,\n  principalType: ManagedPrincipalKind,\n  principalId: string,\n): Promise<PrincipalPolicyCheckpoint | null> {\n  await ensureKeyingCheckpointTables(execSql);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const row = await loadPrincipalPolicyCheckpointRow(db, {\n    principalType,\n    principalId,\n  });\n\n  return row ? { principalType, principalId, ...row } : null;\n}\n/**\n * The shared shape/ownership guard every checkpoint comparison runs before\n * trusting a durable pin: the pin must belong to the compared principal and\n * carry a well-formed version and hash.\n */\nexport function assertPrincipalPolicyCheckpointShape(\n  checkpoint: PrincipalPolicyCheckpoint,\n  head: PrincipalPolicyCheckpointIdentity,\n): void {\n  if (\n    checkpoint.principalType !== head.principalType ||\n    checkpoint.principalId !== head.principalId\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"principal policy checkpoint belongs to another principal\",\n    );\n  }\n  if (\n    !Number.isInteger(checkpoint.version) ||\n    checkpoint.version < 1 ||\n    checkpoint.stateHash.length === 0\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"principal policy checkpoint is malformed\",\n    );\n  }\n}\n"]}

package/data/persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js

@@ -1,5 +1,5 @@
 import { KeyingVerificationError, verifyPrincipalPolicyCheckpoint, } from "../../../internal/crypto/index.js";
-import { loadStoredPrincipalPolicyCheckpoint } from "./keyingCheckpointPersistence.js";
+import { loadStoredPrincipalPolicyCheckpoints, principalPolicyKey, } from "./keyingCheckpointPersistence.js";
 export class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {
     constructor() {
         super("missing_dependency", "Public authorization cannot connect to the latest durable checkpoint");
@@ -7,8 +7,9 @@ export class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVeri
 }
 /** Validate public evidence or a verified private ancestry bridge without admitting pins. */
 export async function validatePrincipalAuthorizationCheckpoints(tx, policies) {
+    const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);
     for (const policy of policies) {
-        const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);
+        const checkpoint = stored.get(principalPolicyKey(policy));
         if (!checkpoint)
             continue;
         const matchingHead = policies.filter((other) => other.principalType === policy.principalType &&

package/data/persistence/keyingCheckpoints/principalAuthorizationCheckpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEpF,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadStoredPrincipalPolicyCheckpoint } from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  for (const policy of policies) {\n    const checkpoint = await loadStoredPrincipalPolicyCheckpoint(tx, policy);\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}
+{"version":3,"file":"principalAuthorizationCheckpoints.js","sourceRoot":"","sources":["principalAuthorizationCheckpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGvB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oCAAoC,EACpC,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,OAAO,gDAAiD,SAAQ,uBAAuB;IAC3F;QACE,KAAK,CACH,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IACJ,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAGG;IAEH,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC5C,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACxC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CACvC,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,IACE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAM,IAAI,gDAAgD,EAAE,CAAC;QAC/D,+BAA+B,CAAC;YAC9B,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport {\n  loadStoredPrincipalPolicyCheckpoints,\n  principalPolicyKey,\n} from \"./keyingCheckpointPersistence\";\n\nexport class PrincipalAuthorizationCheckpointUnavailableError extends KeyingVerificationError {\n  constructor() {\n    super(\n      \"missing_dependency\",\n      \"Public authorization cannot connect to the latest durable checkpoint\",\n    );\n  }\n}\n\n/** Validate public evidence or a verified private ancestry bridge without admitting pins. */\nexport async function validatePrincipalAuthorizationCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly (\n    | VerifiedPrincipalPolicySelection\n    | VerifiedPrincipalPolicyCurrent\n  )[],\n): Promise<void> {\n  const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);\n  for (const policy of policies) {\n    const checkpoint = stored.get(principalPolicyKey(policy));\n    if (!checkpoint) continue;\n    const matchingHead = policies.filter(\n      (other) =>\n        other.principalType === policy.principalType &&\n        other.principalId === policy.principalId &&\n        other.stateHash === policy.stateHash,\n    );\n    const chain = matchingHead.flatMap((other) => other.retainedHistory);\n    if (\n      checkpoint.version > policy.version ||\n      (checkpoint.version < policy.version &&\n        !chain.some(({ state }) => state.version === checkpoint.version))\n    )\n      throw new PrincipalAuthorizationCheckpointUnavailableError();\n    verifyPrincipalPolicyCheckpoint({\n      chain,\n      currentState: policy.state,\n      localCheckpoint: checkpoint,\n    });\n  }\n}\n"]}

package/data/persistence/principalHistory/principalHistoryEvidencePersistence.d.ts

@@ -2,6 +2,7 @@ import { type PrincipalHistoryIndexNode, type PrincipalPolicyHistoryReferencePro
 import { type PrincipalPolicyStateChainEntryResponse } from "../../../internal/validators/response/index.js";
 import { type ClientSQLiteTransactionScope } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { type ExecSql } from "../../sqlite/sqlSchema.js";
+import type { PrincipalHistoryRootEdges } from "./principalHistoryRootOwnership.js";
 export interface PrincipalHistoryEvidencePage {
     readonly indexRootHash: string;
     readonly scopeId: string;
@@ -21,7 +22,19 @@ export declare function preparePrincipalHistoryEvidencePage(input: {
     readonly nodes: readonly PrincipalHistoryIndexNode[];
 }): Promise<PrincipalHistoryEvidencePage>;
 /** Publish in the same guarded transaction as the accepted page's progress. */
-export declare function writePrincipalHistoryEvidencePage(tx: ClientSQLiteTransactionScope, page: PrincipalHistoryEvidencePage): Promise<void>;
+export declare function writePrincipalHistoryEvidencePage(tx: ClientSQLiteTransactionScope, page: PrincipalHistoryEvidencePage, rootEdges?: PrincipalHistoryRootEdges | undefined): Promise<void>;
+/**
+ * Returns untrusted material, in `versions` order. The caller must verify it
+ * against the issued root. Index nodes are read one level at a time for every
+ * version and entries in one set read; the first version that fails, in
+ * order, throws the error loading it alone would.
+ */
+export declare function loadPrincipalHistoryReferences(input: {
+    readonly execSql: ExecSql;
+    readonly scopeId: string;
+    readonly history: VerifiedPrincipalPolicyHistory;
+    readonly versions: readonly number[];
+}): Promise<PrincipalPolicyHistoryReferenceProof[]>;
 /** Returns untrusted material. The caller must verify it against the issued root. */
 export declare function loadPrincipalHistoryReference(input: {
     readonly execSql: ExecSql;

package/data/persistence/principalHistory/principalHistoryEvidencePersistence.js

@@ -1,8 +1,8 @@
 import { compareCanonicalStrings, KeyingVerificationError, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "../../../internal/crypto/index.js";
 import { isPrincipalPolicyStateChainEntryResponse, } from "../../../internal/validators/response/index.js";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { principalHistoryEntries, principalHistoryEvidenceTables, principalHistoryNodes, } from "../../sqlite/schema/principalHistoryEvidenceSchema.js";
-import { sqliteInsertBatchSize } from "../../sqlite/sqliteBindBudget.js";
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../../sqlite/sqliteBindBudget.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { excludedValue } from "../../sqlite/sqliteUpsert.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
@@ -23,7 +23,7 @@ export async function preparePrincipalHistoryEvidencePage(input) {
     };
 }
 /** Publish in the same guarded transaction as the accepted page's progress. */
-export async function writePrincipalHistoryEvidencePage(tx, page) {
+export async function writePrincipalHistoryEvidencePage(tx, page, rootEdges) {
     const scope = { scopeId: page.scopeId, organizationId: page.organizationId };
     // A repeated leaf keeps its last entry, as sequential upserts would.
     const entries = new Map(page.entries.map((entry) => [
@@ -46,47 +46,141 @@ export async function writePrincipalHistoryEvidencePage(tx, page) {
             },
         })
             .run();
-    await writePrincipalHistoryNodes(tx, scope, [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash)));
+    await writePrincipalHistoryNodes(tx, scope, [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash)), rootEdges);
 }
-/** Returns untrusted material. The caller must verify it against the issued root. */
-export async function loadPrincipalHistoryReference(input) {
-    await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);
-    const { db } = getClientSQLitePersistenceRuntime(input.execSql);
-    const resolved = await resolvePrincipalHistoryIndexProof({
-        rootHash: input.history.indexRootHash,
-        treeSize: input.history.currentEntry.state.version,
-        version: input.version,
-        readNode: async (hash) => {
-            const [row] = await db
+// The scope id binds once per lookup.
+const HASH_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);
+/** Thrown by the preloaded node reader to ask the next level's set read for a hash. */
+class PrincipalHistoryNodeNotLoaded {
+    hash;
+    constructor(hash) {
+        this.hash = hash;
+    }
+}
+function hashBatches(hashes) {
+    const result = [];
+    for (let index = 0; index < hashes.length; index += HASH_LOOKUP_BATCH_SIZE)
+        result.push(hashes.slice(index, index + HASH_LOOKUP_BATCH_SIZE));
+    return result;
+}
+/**
+ * Resolves every version's index path level by level: each pass walks every
+ * unfinished version over the nodes read so far, and one set read per level
+ * supplies the nodes the walks stopped at. A node absent after its read stays
+ * missing, so the unchanged verifier fails that version as it would serially.
+ */
+async function resolvePrincipalHistoryProofs(db, input) {
+    const nodes = new Map();
+    const results = [];
+    let pending = input.versions.map((_, index) => index);
+    while (pending.length > 0) {
+        const needed = new Set();
+        const unfinished = [];
+        for (const index of pending) {
+            try {
+                results[index] = {
+                    value: await resolvePrincipalHistoryIndexProof({
+                        rootHash: input.history.indexRootHash,
+                        treeSize: input.history.currentEntry.state.version,
+                        version: input.versions[index] ?? 0,
+                        readNode: async (hash) => {
+                            const node = nodes.get(hash);
+                            if (node === undefined)
+                                throw new PrincipalHistoryNodeNotLoaded(hash);
+                            return node;
+                        },
+                    }),
+                };
+            }
+            catch (error) {
+                if (!(error instanceof PrincipalHistoryNodeNotLoaded)) {
+                    results[index] = { error };
+                    continue;
+                }
+                needed.add(error.hash);
+                unfinished.push(index);
+            }
+        }
+        for (const batch of hashBatches([...needed])) {
+            for (const hash of batch)
+                nodes.set(hash, null);
+            const rows = await db
                 .select()
                 .from(principalHistoryNodes)
-                .where(and(eq(principalHistoryNodes.scopeId, input.scopeId), eq(principalHistoryNodes.hash, hash)))
-                .limit(1);
-            return row ?? null;
-        },
-    });
-    const [row] = await db
-        .select()
-        .from(principalHistoryEntries)
-        .where(and(eq(principalHistoryEntries.scopeId, input.scopeId), eq(principalHistoryEntries.leafHash, resolved.leafHash)))
-        .limit(1);
+                .where(and(eq(principalHistoryNodes.scopeId, input.scopeId), inArray(principalHistoryNodes.hash, batch)));
+            for (const row of rows)
+                nodes.set(row.hash, row);
+        }
+        pending = unfinished;
+    }
+    return results;
+}
+async function loadPrincipalHistoryEntryJson(db, scopeId, leafHashes) {
+    const entries = new Map();
+    for (const batch of hashBatches([...new Set(leafHashes)])) {
+        const rows = await db
+            .select({
+            leafHash: principalHistoryEntries.leafHash,
+            entryJson: principalHistoryEntries.entryJson,
+        })
+            .from(principalHistoryEntries)
+            .where(and(eq(principalHistoryEntries.scopeId, scopeId), inArray(principalHistoryEntries.leafHash, batch)));
+        for (const row of rows)
+            entries.set(row.leafHash, row.entryJson);
+    }
+    return entries;
+}
+function parsePrincipalHistoryEntry(entryJson) {
     let entry;
     try {
-        entry = row ? JSON.parse(row.entryJson) : null;
+        entry = entryJson === undefined ? null : JSON.parse(entryJson);
     }
     catch {
         entry = null;
     }
     if (!isPrincipalPolicyStateChainEntryResponse(entry))
         throw new KeyingVerificationError("missing_dependency", "Principal history entry is missing or corrupt");
-    const reference = input.expectedReference ?? {
-        principalType: entry.state.principalType,
-        principalId: entry.state.principalId,
-        version: entry.state.version,
-        keyEpoch: entry.state.keyEpoch,
-        stateHash: entry.state.stateHash,
-        keyFingerprint: entry.state.keyFingerprint,
-    };
-    return { reference, entry, proof: resolved.proof };
+    return entry;
+}
+/**
+ * Returns untrusted material, in `versions` order. The caller must verify it
+ * against the issued root. Index nodes are read one level at a time for every
+ * version and entries in one set read; the first version that fails, in
+ * order, throws the error loading it alone would.
+ */
+export async function loadPrincipalHistoryReferences(input) {
+    await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);
+    const { db } = getClientSQLitePersistenceRuntime(input.execSql);
+    const resolved = await resolvePrincipalHistoryProofs(db, input);
+    const entries = await loadPrincipalHistoryEntryJson(db, input.scopeId, resolved.flatMap((result) => "value" in result ? [result.value.leafHash] : []));
+    return resolved.map((result) => {
+        if (!("value" in result))
+            throw result.error;
+        const entry = parsePrincipalHistoryEntry(entries.get(result.value.leafHash));
+        return {
+            reference: {
+                principalType: entry.state.principalType,
+                principalId: entry.state.principalId,
+                version: entry.state.version,
+                keyEpoch: entry.state.keyEpoch,
+                stateHash: entry.state.stateHash,
+                keyFingerprint: entry.state.keyFingerprint,
+            },
+            entry,
+            proof: result.value.proof,
+        };
+    });
+}
+/** Returns untrusted material. The caller must verify it against the issued root. */
+export async function loadPrincipalHistoryReference(input) {
+    const [loaded] = await loadPrincipalHistoryReferences({
+        ...input,
+        versions: [input.version],
+    });
+    if (!loaded)
+        throw new Error("Principal history reference was not loaded");
+    return input.expectedReference
+        ? { ...loaded, reference: input.expectedReference }
+        : loaded;
 }
 //# sourceMappingURL=principalHistoryEvidencePersistence.js.map

package/data/persistence/principalHistory/principalHistoryEvidencePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAa9E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC;IAElC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,KAAK,CAAC,QAAQ;QACd,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KACnE,CAAC,CACH,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,sBAAsB;QACtE,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAAC,CAAC;aACzD,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,uBAAuB,CAAC,cAAc,CAAC;gBACrE,SAAS,EAAE,aAAa,CAAC,uBAAuB,CAAC,SAAS,CAAC;aAC5D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,0BAA0B,CAC9B,EAAE,EACF,KAAK,EACL,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC;QACvD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CACrC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAClD,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACxD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI;QAC3C,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../../sqlite/schema/principalHistoryEvidenceSchema\";\nimport { sqliteInsertBatchSize } from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { writePrincipalHistoryNodes } from \"./principalHistoryNodeRetention\";\n\nconst ENTRY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryEntries);\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  // A repeated leaf keeps its last entry, as sequential upserts would.\n  const entries = new Map(\n    page.entries.map((entry) => [\n      entry.leafHash,\n      { ...scope, leafHash: entry.leafHash, entryJson: entry.entryJson },\n    ]),\n  );\n  const rows = [...entries.values()].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  );\n  for (let index = 0; index < rows.length; index += ENTRY_WRITE_BATCH_SIZE)\n    await tx\n      .insert(principalHistoryEntries)\n      .values(rows.slice(index, index + ENTRY_WRITE_BATCH_SIZE))\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: {\n          organizationId: excludedValue(principalHistoryEntries.organizationId),\n          entryJson: excludedValue(principalHistoryEntries.entryJson),\n        },\n      })\n      .run();\n  await writePrincipalHistoryNodes(\n    tx,\n    scope,\n    [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash)),\n  );\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryIndexProof({\n    rootHash: input.history.indexRootHash,\n    treeSize: input.history.currentEntry.state.version,\n    version: input.version,\n    readNode: async (hash) => {\n      const [row] = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            eq(principalHistoryNodes.hash, hash),\n          ),\n        )\n        .limit(1);\n      return row ?? null;\n    },\n  });\n  const [row] = await db\n    .select()\n    .from(principalHistoryEntries)\n    .where(\n      and(\n        eq(principalHistoryEntries.scopeId, input.scopeId),\n        eq(principalHistoryEntries.leafHash, resolved.leafHash),\n      ),\n    )\n    .limit(1);\n  let entry: unknown;\n  try {\n    entry = row ? JSON.parse(row.entryJson) : null;\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  const reference = input.expectedReference ?? {\n    principalType: entry.state.principalType,\n    principalId: entry.state.principalId,\n    version: entry.state.version,\n    keyEpoch: entry.state.keyEpoch,\n    stateHash: entry.state.stateHash,\n    keyFingerprint: entry.state.keyFingerprint,\n  };\n  return { reference, entry, proof: resolved.proof };\n}\n"]}
+{"version":3,"file":"principalHistoryEvidencePersistence.js","sourceRoot":"","sources":["principalHistoryEvidencePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAGlC,yBAAyB,EAEzB,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wCAAwC,GAEzC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAG7E,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAa9E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAMzD;IACC,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kCAAkC;QACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAkC;QAE3D,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;IACJ,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAgC,EAChC,IAAkC,EAClC,SAAiD;IAEjD,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,KAAK,CAAC,QAAQ;QACd,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KACnE,CAAC,CACH,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/C,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAChD,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,sBAAsB;QACtE,MAAM,EAAE;aACL,MAAM,CAAC,uBAAuB,CAAC;aAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAAC,CAAC;aACzD,kBAAkB,CAAC;YAClB,MAAM,EAAE;gBACN,uBAAuB,CAAC,OAAO;gBAC/B,uBAAuB,CAAC,QAAQ;aACjC;YACD,GAAG,EAAE;gBACH,cAAc,EAAE,aAAa,CAAC,uBAAuB,CAAC,cAAc,CAAC;gBACrE,SAAS,EAAE,aAAa,CAAC,uBAAuB,CAAC,SAAS,CAAC;aAC5D;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,MAAM,0BAA0B,CAC9B,EAAE,EACF,KAAK,EACL,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EACvE,SAAS,CACV,CAAC;AACJ,CAAC;AAOD,sCAAsC;AACtC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE5D,uFAAuF;AACvF,MAAM,6BAA6B;IACZ;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;CACtC;AAED,SAAS,WAAW,CAAC,MAAyB;IAC5C,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,sBAAsB;QACxE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6BAA6B,CAC1C,EAAwB,EACxB,KAIC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,OAAO,GAGP,EAAE,CAAC;IACT,IAAI,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,iCAAiC,CAAC;wBAC7C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;wBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;wBAClD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;wBACnC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;4BACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BAC7B,IAAI,IAAI,KAAK,SAAS;gCACpB,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;4BAChD,OAAO,IAAI,CAAC;wBACd,CAAC;qBACF,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,6BAA6B,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;oBAC3B,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,qBAAqB,CAAC;iBAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAChD,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAC3C,CACF,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,EAAwB,EACxB,OAAe,EACf,UAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;YAC1C,SAAS,EAAE,uBAAuB,CAAC,SAAS;SAC7C,CAAC;aACD,IAAI,CAAC,uBAAuB,CAAC;aAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,EAC5C,OAAO,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CACjD,CACF,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,0BAA0B,CACjC,SAA6B;IAE7B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,wCAAwC,CAAC,KAAK,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,EAAE,EACF,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1B,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QAC7C,MAAM,KAAK,GAAG,0BAA0B,CACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,OAAO;YACL,SAAS,EAAE;gBACT,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;aAC3C;YACD,KAAK;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,8BAA8B,CAAC;QACpD,GAAG,KAAK;QACR,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC,iBAAiB;QAC5B,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE;QACnD,CAAC,CAAC,MAAM,CAAC;AACb,CAAC","sourcesContent":["import {\n  compareCanonicalStrings,\n  KeyingVerificationError,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type PrincipalHistoryIndexNode,\n  type PrincipalPolicyHistoryReferenceProof,\n  principalHistoryIndexLeaf,\n  type ReferencedPrincipalHead,\n  resolvePrincipalHistoryIndexProof,\n  type VerifiedPrincipalPolicyHistory,\n} from \"@tearleads/crypto\";\nimport {\n  isPrincipalPolicyStateChainEntryResponse,\n  type PrincipalPolicyStateChainEntryResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  principalHistoryEntries,\n  principalHistoryEvidenceTables,\n  principalHistoryNodes,\n} from \"../../sqlite/schema/principalHistoryEvidenceSchema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { excludedValue } from \"../../sqlite/sqliteUpsert\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { writePrincipalHistoryNodes } from \"./principalHistoryNodeRetention\";\nimport type { PrincipalHistoryRootEdges } from \"./principalHistoryRootOwnership\";\n\nconst ENTRY_WRITE_BATCH_SIZE = sqliteInsertBatchSize(principalHistoryEntries);\n\nexport interface PrincipalHistoryEvidencePage {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly {\n    readonly leafHash: string;\n    readonly entryJson: string;\n  }[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\n/** Prepare only a page accepted by the signature/authorization verifier. */\nexport async function preparePrincipalHistoryEvidencePage(input: {\n  readonly indexRootHash: string;\n  readonly scopeId: string;\n  readonly organizationId: string;\n  readonly entries: readonly PrincipalPolicyStateChainEntryResponse[];\n  readonly nodes: readonly PrincipalHistoryIndexNode[];\n}): Promise<PrincipalHistoryEvidencePage> {\n  if (\n    input.entries.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT ||\n    input.nodes.length > 2 * PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal evidence page exceeds its batch budget\",\n    );\n  const owned = structuredClone(input);\n  return {\n    ...owned,\n    entries: await Promise.all(\n      owned.entries.map(async (entry) => ({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        entryJson: JSON.stringify(entry),\n      })),\n    ),\n  };\n}\n\n/** Publish in the same guarded transaction as the accepted page's progress. */\nexport async function writePrincipalHistoryEvidencePage(\n  tx: ClientSQLiteTransactionScope,\n  page: PrincipalHistoryEvidencePage,\n  rootEdges?: PrincipalHistoryRootEdges | undefined,\n): Promise<void> {\n  const scope = { scopeId: page.scopeId, organizationId: page.organizationId };\n  // A repeated leaf keeps its last entry, as sequential upserts would.\n  const entries = new Map(\n    page.entries.map((entry) => [\n      entry.leafHash,\n      { ...scope, leafHash: entry.leafHash, entryJson: entry.entryJson },\n    ]),\n  );\n  const rows = [...entries.values()].sort((a, b) =>\n    compareCanonicalStrings(a.leafHash, b.leafHash),\n  );\n  for (let index = 0; index < rows.length; index += ENTRY_WRITE_BATCH_SIZE)\n    await tx\n      .insert(principalHistoryEntries)\n      .values(rows.slice(index, index + ENTRY_WRITE_BATCH_SIZE))\n      .onConflictDoUpdate({\n        target: [\n          principalHistoryEntries.scopeId,\n          principalHistoryEntries.leafHash,\n        ],\n        set: {\n          organizationId: excludedValue(principalHistoryEntries.organizationId),\n          entryJson: excludedValue(principalHistoryEntries.entryJson),\n        },\n      })\n      .run();\n  await writePrincipalHistoryNodes(\n    tx,\n    scope,\n    [...page.nodes].sort((a, b) => compareCanonicalStrings(a.hash, b.hash)),\n    rootEdges,\n  );\n}\n\ntype PrincipalHistoryNodeRow = typeof principalHistoryNodes.$inferSelect;\ntype ResolvedPrincipalHistoryProof = Awaited<\n  ReturnType<typeof resolvePrincipalHistoryIndexProof>\n>;\n\n// The scope id binds once per lookup.\nconst HASH_LOOKUP_BATCH_SIZE = sqliteRowsPerStatement(1, 1);\n\n/** Thrown by the preloaded node reader to ask the next level's set read for a hash. */\nclass PrincipalHistoryNodeNotLoaded {\n  constructor(readonly hash: string) {}\n}\n\nfunction hashBatches(hashes: readonly string[]): string[][] {\n  const result: string[][] = [];\n  for (let index = 0; index < hashes.length; index += HASH_LOOKUP_BATCH_SIZE)\n    result.push(hashes.slice(index, index + HASH_LOOKUP_BATCH_SIZE));\n  return result;\n}\n\n/**\n * Resolves every version's index path level by level: each pass walks every\n * unfinished version over the nodes read so far, and one set read per level\n * supplies the nodes the walks stopped at. A node absent after its read stays\n * missing, so the unchanged verifier fails that version as it would serially.\n */\nasync function resolvePrincipalHistoryProofs(\n  db: ClientSQLiteDatabase,\n  input: {\n    readonly scopeId: string;\n    readonly history: VerifiedPrincipalPolicyHistory;\n    readonly versions: readonly number[];\n  },\n): Promise<({ value: ResolvedPrincipalHistoryProof } | { error: unknown })[]> {\n  const nodes = new Map<string, PrincipalHistoryNodeRow | null>();\n  const results: (\n    | { value: ResolvedPrincipalHistoryProof }\n    | { error: unknown }\n  )[] = [];\n  let pending = input.versions.map((_, index) => index);\n  while (pending.length > 0) {\n    const needed = new Set<string>();\n    const unfinished: number[] = [];\n    for (const index of pending) {\n      try {\n        results[index] = {\n          value: await resolvePrincipalHistoryIndexProof({\n            rootHash: input.history.indexRootHash,\n            treeSize: input.history.currentEntry.state.version,\n            version: input.versions[index] ?? 0,\n            readNode: async (hash) => {\n              const node = nodes.get(hash);\n              if (node === undefined)\n                throw new PrincipalHistoryNodeNotLoaded(hash);\n              return node;\n            },\n          }),\n        };\n      } catch (error) {\n        if (!(error instanceof PrincipalHistoryNodeNotLoaded)) {\n          results[index] = { error };\n          continue;\n        }\n        needed.add(error.hash);\n        unfinished.push(index);\n      }\n    }\n    for (const batch of hashBatches([...needed])) {\n      for (const hash of batch) nodes.set(hash, null);\n      const rows = await db\n        .select()\n        .from(principalHistoryNodes)\n        .where(\n          and(\n            eq(principalHistoryNodes.scopeId, input.scopeId),\n            inArray(principalHistoryNodes.hash, batch),\n          ),\n        );\n      for (const row of rows) nodes.set(row.hash, row);\n    }\n    pending = unfinished;\n  }\n  return results;\n}\n\nasync function loadPrincipalHistoryEntryJson(\n  db: ClientSQLiteDatabase,\n  scopeId: string,\n  leafHashes: readonly string[],\n): Promise<Map<string, string>> {\n  const entries = new Map<string, string>();\n  for (const batch of hashBatches([...new Set(leafHashes)])) {\n    const rows = await db\n      .select({\n        leafHash: principalHistoryEntries.leafHash,\n        entryJson: principalHistoryEntries.entryJson,\n      })\n      .from(principalHistoryEntries)\n      .where(\n        and(\n          eq(principalHistoryEntries.scopeId, scopeId),\n          inArray(principalHistoryEntries.leafHash, batch),\n        ),\n      );\n    for (const row of rows) entries.set(row.leafHash, row.entryJson);\n  }\n  return entries;\n}\n\nfunction parsePrincipalHistoryEntry(\n  entryJson: string | undefined,\n): PrincipalPolicyStateChainEntryResponse {\n  let entry: unknown;\n  try {\n    entry = entryJson === undefined ? null : JSON.parse(entryJson);\n  } catch {\n    entry = null;\n  }\n  if (!isPrincipalPolicyStateChainEntryResponse(entry))\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal history entry is missing or corrupt\",\n    );\n  return entry;\n}\n\n/**\n * Returns untrusted material, in `versions` order. The caller must verify it\n * against the issued root. Index nodes are read one level at a time for every\n * version and entries in one set read; the first version that fails, in\n * order, throws the error loading it alone would.\n */\nexport async function loadPrincipalHistoryReferences(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly versions: readonly number[];\n}): Promise<PrincipalPolicyHistoryReferenceProof[]> {\n  await ensureSqlTables(input.execSql, principalHistoryEvidenceTables);\n  const { db } = getClientSQLitePersistenceRuntime(input.execSql);\n  const resolved = await resolvePrincipalHistoryProofs(db, input);\n  const entries = await loadPrincipalHistoryEntryJson(\n    db,\n    input.scopeId,\n    resolved.flatMap((result) =>\n      \"value\" in result ? [result.value.leafHash] : [],\n    ),\n  );\n  return resolved.map((result) => {\n    if (!(\"value\" in result)) throw result.error;\n    const entry = parsePrincipalHistoryEntry(\n      entries.get(result.value.leafHash),\n    );\n    return {\n      reference: {\n        principalType: entry.state.principalType,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        keyEpoch: entry.state.keyEpoch,\n        stateHash: entry.state.stateHash,\n        keyFingerprint: entry.state.keyFingerprint,\n      },\n      entry,\n      proof: result.value.proof,\n    };\n  });\n}\n\n/** Returns untrusted material. The caller must verify it against the issued root. */\nexport async function loadPrincipalHistoryReference(input: {\n  readonly execSql: ExecSql;\n  readonly scopeId: string;\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly version: number;\n  readonly expectedReference?: ReferencedPrincipalHead | undefined;\n}): Promise<PrincipalPolicyHistoryReferenceProof> {\n  const [loaded] = await loadPrincipalHistoryReferences({\n    ...input,\n    versions: [input.version],\n  });\n  if (!loaded) throw new Error(\"Principal history reference was not loaded\");\n  return input.expectedReference\n    ? { ...loaded, reference: input.expectedReference }\n    : loaded;\n}\n"]}